Cookie Policy

1. What cookies and similar technologies are

Cookies are small pieces of data that a website can ask a browser to store and return with later requests. Similar technologies can include browser local storage, tracking pixels, SDK identifiers and script-generated device or session identifiers. The privacy impact depends on what a technology does, who receives the data and whether it is essential for a service requested by the user.

Some cookies are technically necessary for security or a requested function. Others are used for audience measurement, personalisation, advertising or cross-site tracking. These categories should not be treated as interchangeable.

2. Current Nortixa implementation

The production package supplied for nortixa.online has no GA4 Measurement ID, Google Tag Manager container, Cookiebot Domain Group ID, reCAPTCHA key, Google Maps embed or advertising tag configured. Those integrations are therefore not intentionally loaded by the supplied code. The site does not currently implement behavioural advertising, marketing audiences or analytics measurement.

This description is intentionally specific to the current code. If the deployed site is later modified by a hosting platform, CDN, tag manager, plugin or other service that introduces additional storage, this policy must be updated to describe what actually happens.

3. Essential session technology on the contact form

The contact page uses a server-side PHP session to store a random anti-CSRF token. CSRF protection helps prevent another website from silently submitting a form on your behalf. Depending on the PHP/server configuration, the browser may receive a session cookie such as PHPSESSID. That cookie is considered operationally necessary for the protected form.

The token is not designed to identify medical conditions, build an advertising profile, remember browsing interests or measure campaign performance. Nortixa does not deliberately place health information inside the session. Session lifetime and cookie attributes can vary with the actual server configuration, so this package does not invent a precise expiry value that may be false after deployment.

4. The private symptom-note tool

The symptom-note page is deliberately implemented without persistence. Checkbox selections and the optional note live only in the current page's JavaScript state. The tool does not send those entries to Nortixa, does not write them to cookies, does not save them to localStorage and does not create a server-side record. Refreshing or leaving the page clears the working note.

If a future version adds saved notes, accounts, synchronisation or cloud storage, that would be a materially different privacy design and would require a fresh legal and security review before launch.

5. Services not active in this build

• Google Analytics 4: no real Measurement ID was provided.
• Google Tag Manager: no real container ID was provided.
• Cookiebot: no Domain Group ID was provided.
• Advertising or remarketing tags: none are configured.
• reCAPTCHA: no key was provided; the form instead uses CSRF protection, validation and a honeypot.
• Google Maps: no map is embedded.
• Affiliate tracking: no partner or CTA destination was provided, so no affiliate tracking link is active.

6. Hosting and security logs

Most web servers and hosting environments can generate technical access or error logs that include an IP address, time, requested URL, response status and user-agent string. The hosting provider and its final configuration were not supplied for this build. Nortixa therefore cannot truthfully name a provider, storage location or exact log-retention period in advance.

Once hosting is selected, the operator should review server, CDN, firewall and mail logs and document any cookies or identifiers they introduce. Technical logs should be limited to legitimate operational and security purposes and retained no longer than necessary for those purposes or applicable legal obligations.

7. Your browser controls

Modern browsers allow you to inspect, block and delete cookies. You can usually remove site data through privacy settings or developer tools. Blocking all cookies can interfere with the contact form if the server relies on a session cookie for CSRF protection. The educational articles themselves do not require a login or advertising cookie.

“Do Not Track” and similar browser signals are not used here as a substitute for a clear consent system. If optional tracking is later implemented, the operator should adopt a consent design appropriate to the technologies and legal obligations actually in use.

8. Third-party source links

Nortixa links to official health, legal and media-source pages. Clicking such a link leaves nortixa.online. The destination website may set its own cookies or collect technical data according to its own policies. Nortixa does not control those third-party storage practices merely because it provides a citation link.

9. What must happen before analytics or affiliate tracking is enabled

Before enabling an optional analytics, advertising or affiliate-tracking technology, the site should identify the provider, data elements, purpose, recipients, storage duration, transfer locations and the consent or other lawful-basis requirements that apply. The Privacy Policy and this Cookie Policy should then be updated to match the real implementation rather than generic template language.

If a consent-management platform is introduced, it should not falsely claim to block technologies that still load before consent. Analytics and advertising scripts should be technically connected to the consent state where required.

10. Policy changes

This policy should be reviewed whenever a new tag, embed, chat widget, map, captcha, analytics tool, affiliate network, user account or personalisation feature is added. Material changes should update the date at the top of the page and explain the new technology accurately.

11. Contact

Questions about cookies or site storage may be sent to [email protected] or raised through the non-medical contact form. Please do not include symptoms, diagnoses or other health information in a cookie/privacy message.